Rule History

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"ET MALWARE W32/Liftoh.Downloader Get Final Payload Request"; flow:established,to_server; http.uri; content:"/get/"; content:"/final"; http.cookie; content:"ip="; depth:3; pcre:"/^[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}\x2E[0-9]{1,3}/R"; reference:url,www.secureworks.com/cyber-threat-intelligence/threats/spam-campaign-delivers-liftoh-downloader/; classtype:trojan-activity; sid:2017870; rev:4; metadata:created_at 2013_12_17, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2020_04_27;)